What is a COLP? Duties, the COFA and who can be one

Stands for

Compliance officer for legal practice

Duties set out in

SRA Code of Conduct for Firms, paragraph 9.1

Must be

An authorised lawyer, and a manager or employee of the firm

Works alongside

The COFA, compliance officer for finance and administration

What does COLP stand for?

COLP stands for compliance officer for legal practice. Every firm the SRA authorises must have one, alongside a COFA (compliance officer for finance and administration), and the SRA must approve both. In an alternative business structure the roles are called the HOLP and the HOFA.

What is a COLP in a law firm?

The COLP must take all reasonable steps to make sure the firm, its managers and its staff comply with the SRA's rules and the firm's authorisation, and that serious breaches reach the SRA promptly. The duties are in paragraph 9.1 of the SRA Code of Conduct for Firms.

The COLP doesn't carry this alone. Every manager is responsible for the firm's compliance (paragraph 8.1), and the firm must give its compliance officers the systems to do the job (paragraph 2.1).

What does a COLP do?

Paragraph 9.1 sets out five duties. The COLP must take all reasonable steps to make sure that:

1. the firm keeps to the terms and conditions of its authorisation;
2. the firm, its managers, employees and interest holders comply with the SRA's rules that apply to them;
3. managers and interest holders, and the people they employ or contract with, don't cause or substantially contribute to a breach;
4. a prompt report goes to the SRA about anything the COLP reasonably believes could amount to a serious breach;
5. the SRA is told promptly about anything it should know in order to investigate.

The Accounts Rules belong to the COFA. Day to day, the job means watching how the firm's systems run, recording every breach and judging which are serious.

What is the difference between a COLP and a COFA?

The COLP covers the SRA's rules in general. The COFA covers the SRA Accounts Rules, which deal with client money and client accounts. Each must take all reasonable steps to make sure their rules are followed and serious breaches in their area are reported.

Does a COLP have to be a solicitor?

No. A COLP must be authorised by an approved regulator to carry on reserved legal activities, so a solicitor qualifies, and so can a lawyer from another profession whose regulator authorises them. A COFA needn't be a lawyer at all. Both rules are in rule 8.2 of the SRA Authorisation of Firms Rules.

Who can be a COLP?

The SRA must approve them. Under rule 8.2 they must be a manager or employee of the firm, consent to the role, not be disqualified under section 99 of the Legal Services Act 2007, and be authorised to carry on reserved legal activities.

Rule 8.3 also allows a compliance officer already approved at a related firm, one with a manager or owner in common, who works for that firm.

Can the same person be the COLP and the COFA?

Yes. Rule 8.1 asks for an individual in each role and doesn't require two people. The SRA's guidance covers a sole practitioner holding both, and expects them to review how well they do each. In any firm, management should review its compliance officers.

What records should a COLP keep?

Every breach, serious or not. The firm must keep records that show it complies (paragraph 2.2 of the Code for Firms), and the SRA's guidance expects compliance officers to record all breaches so they can spot patterns. The SRA doesn't prescribe a format.

Each entry should let someone who wasn't there see what happened, why it was or wasn't serious, and what changed afterwards.

When does a COLP have to report to the SRA?

When the COLP reasonably believes something could amount to a serious breach, they must make sure the SRA gets a prompt report, and tell it promptly about anything it should know to investigate. The SRA's reporting and notification guidance explains what counts. The SRA is reviewing this guidance after a High Court decision in September 2026.

Some events must be notified regardless. Breaches that aren't serious still go in the breach record.

Does AI use fall under the COLP's duties?

Yes. The SRA's AI warning notice of 17 August 2026 says firms need governance and controls for the risks AI brings, and that the COLP must take all reasonable steps on compliance, including supervision. Its two concerns are invented citations put before courts and client information going into tools without safeguards.

What a COLP can check before the firm uses AI

1. 01A written rule on which AI tools staff may use, and which may see client information.
2. 02Any tool that sees client information keeps it secure, doesn't train on it unless authorised, and doesn't hold it longer than needed.
3. 03A named person checks every output before it leaves the firm, and every citation against its source.
4. 04Staff know the rule and how to use the approved tools.
5. 05AI problems go in the breach record like any other.

Drawn from the SRA's notice, which has no checklist of its own.